active-directory-skill

To detect Kerberoasting using Windows event logs, you analyze Event ID 4769 for unusual Kerberos Ticket Granting Service requests with specific encryption types. This skill generates targeted detection queries and defense strategies for Kerberos-based attacks.

Monitoring Active Directory privilege escalation in ELK involves ingesting Windows event logs and building Kibana dashboards to track unauthorized access token modifications. This skill provides ELK-integrated threat detection workflows and analytics queries for incident response.

Yes, you can use this skill for Pass-the-Ticket detection by correlating Event IDs 4769 and 4624 to identify anomalous Kerberos ticket usage. It provides a comprehensive detection plan and practical queries for Windows event-log based threat hunting.

LDAP query monitoring helps with Active Directory threat detection by exposing abnormal directory search patterns that indicate reconnaissance or domain trust abuse. This skill covers LDAP operations and provides log-analysis detections to support threat hunting workflows.

Yes, this skill provides Kibana queries for Windows event log analysis to detect Active Directory attack techniques. It integrates with ELK workflows to support incident response, producing specific detection queries for Kerberos, LDAP, and privilege escalation events.